API reference

Every endpoint the management API exposes — 94 of them across 19 groups. These pages are generated from the API's own OpenAPI document, so they describe exactly what the running service accepts.

Everything except the health check expects an Authorization: Bearer header. Version 0.0.0; all versioned routes live under /v1.

Endpoint groups

• Health2 endpointsUnversioned liveness/readiness checks — outside /v1, and not part of the API's data contract (see app's doc comment and specs/060-obs-service-telemetry-baseline/contracts/health.md).get
• Organizations5 endpointsThe top level of the Organization → Environment → ChargingStation hierarchy (see docs/architecture/tenancy.md) — create, rename, and look up organizations.getpostpatch
• Environments9 endpointsEnvironments group a charging station fleet within an organization (e.g. prod/staging) and are what command/read authorization is actually scoped to.getpostpatchdelete
• Members7 endpointsOrganization membership, roles (Owner/Admin/User), and per-environment access grants for User-role members.getpostpatchdelete
• ChargingStations7 endpointsProvisioning, credentials, and lifecycle for real OCPP 1.6J charging stations.getdeletepost
• EVSEs & Connectors3 endpointsA charging station's EVSEs and connectors as reported by ingestion — read-only except for a circuit assignment, no direct creation endpoint.getpatch
• Sites & Circuits10 endpointsPhysical locations (Sites) within an environment and the circuit wiring tree (Circuits) connecting their charging stations — see docs/architecture/tenancy.md.getpatchdeletepost
• Transactions6 endpointsCharging session history: start/stop, id token, duration, stop reason, and each transaction's full event log.getput
• Meter Values2 endpointsStandalone (non-transaction) meter readings — a connector's main-meter or no-session readings.get
• Configuration2 endpointsA charging station's cached configuration keys — a fast read backed by the last successful get-configuration/change-configuration command, not a live round-trip.get
• Commands17 endpointsCSMS-initiated OCPP commands. Each blocks until the charging station answers (up to ~35s) or the request times out — see each endpoint's own status codes for how a charging station's answer, timeout, or disconnection are told apart.post
• Command History1 endpointAudit trail of every command issued to a charging station and how it answered — the only record of a DataTransfer payload this CSMS cannot interpret on its own.get
• Charging Limits4 endpointsInstall, list, and remove charging limits — what a charging station (or one connector, or one active session) is allowed to draw, and when. See docs/architecture/api-gateway-roadmap.md's "Protocol opacity" section: nothing here names OCPP's own charging-profile vocabulary.getpostdelete
• Metrics1 endpointFleet telemetry (voltage, current, temperature, etc.) backed by VictoriaMetrics, not Postgres — see docs/architecture's metrics-storage notes. Only three fixed lookback windows are exposed; arbitrary PromQL is not, since VictoriaMetrics itself is not reachable from outside this process.get
• Live events1 endpointA Server-Sent Events stream of what an environment's charging stations are doing right now, so a client doesn't have to poll — see docs/architecture/live-charger-updates-roadmap.md. Events are nudges to refetch, delivered best-effort: reconcile over the REST endpoints on connect and after every reconnect.get
• Authorization8 endpointsThe id-token registry: which tokens an environment authorizes, and their lifecycle. Admin manages the registry; recovering a token's *value* takes Owner and is audited — see docs/adr/0007-the-authorization-registry-stores-recoverable-token-values.md. No listing endpoint ever returns a token value.getpostdelete
• Local authorization list2 endpointsThe per-charging station allow-list a charging station authorizes against while offline (OCPP 1.6 §3.5.2). Curating a list selects from the id-token registry and takes Admin; pushing one to a charging station takes Owner and is recorded, because it puts token values on a wire — see docs/adr/0008-pushing-an-authorization-list-is-not-a-reveal.md. The push itself lives under Commands.getput
• Energy3 endpointsDay-ahead electricity price forecasts collected from ENTSO-E — see docs/architecture/energy-price-forecast-roadmap.md. Public market data: a raw zone= query needs no organization context, only a valid bearer token.get
• Webhooks4 endpointsThird-party integrator subscriptions — see specs/005-api-external-webhooks/. User reads, Admin creates/deletes (FR-019). This service only owns the subscription resource and recent delivery outcomes; webhook-dispatcher is the only writer of a delivery, running as its own deployable service so a slow receiver never touches this API's runtime (FR-008/FR-009).getpostdelete